SonicWall Email Security Unauthenticated Arbitrary User Creation (CVE-2021-20021) M2

Tim Peck@timpeck

•updated Nov 11, 2025•0•34

This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.